Vulnerability · Published Oct 30, 2023 · Assigned by GitHub_M
CVE-2023-41891FlyteAdmin SQL Injection in List Filters
Low 3.5
In plain English
A low-severity SQL injection in flyteadmin from flyteorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/flyteorg/flyteadmin | 1.1.124 | GO-2023-2162 |
| Go | github.com/flyteorg/flyteadmin | 1.1.124 | GHSA-r847-6w6h-r8g4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| flyteorg | flyteadmin | < 1.1.124 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N